mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
621 stars 43 forks source link

Stop depending on PackageId format for node ordering #603

Closed mystor closed 3 months ago

mystor commented 3 months ago

In https://github.com/rust-lang/cargo/pull/12914, the format used for PackageId strings in cargo metadata was changed. This led to a number of test failures due to the ordering of nodes when logging graphs changing relative to earlier versions of cargo.

To work around this issue, the ordering of nodes in the graph was changed to be based on package name and version explicitly, rather than implicitly through the PackageId string. This slightly changes the ordering of some crates in outputs.

In addition, in order to keep tests passing across all versions, the package_id member has been hidden from the JSON graph dump output. This field was already missing for path dependencies.

Fixes #602